Method and system for using a microcircuit card in a plurality of applications

ABSTRACT

The method comprises the steps of: coupling the card ( 24 ) as initially configured for the default application, with a terminal ( 14 ) of the default application, executing a special transaction for reconfiguring the software of the card for the target application so that the card as reconfigured in this way emulates a card specific to the target application; coupling the card as reconfigured in this way with a terminal ( 18 ) of the target application; and executing a transaction of the target application. Subsequently, the card as reconfigured for the target application can be coupled with a terminal of the default application, and another special transaction can be executed to return the card to its software configuration for the default application. In particular, the default application can be a SIM card application for GSM radiotelephony, and the target application can be a token-carrier type application.

BACKGROUND OF THE INVENTION

The invention relates to microcircuit cards.

Nowadays, these cards are used in numerous applications such as paymentat a point of sale (known as the “bank card” application), publictelephones, paying for parking, paying for TV, mobile telephones (GSM),health services, public transport, or electronic purse.

These applications are becoming more and more numerous, and their use isbecoming more and more widespread.

Each of these applications is associated with a specific card: a bankcard, a phone card, a parking card, an IC card for a television decoder,a SIM card for GSM telephony, etc.

One of the problems encountered in daily use of such a variety of cardslies in such-and-such a card of a type required by any specific one ofthese applications being accidentally unavailable, whether because ithas been forgotten, because it is empty or has run out, or because it isinvalid or has expired.

This problem is made worse by the fact that certain types of card aresometimes poorly distributed, or are used so rarely that it is quitelikely they will not be in the user's pocket at all times. A typicalcase is that of parking cards, which are issued and usable in any onegiven city only, and for which a need can arise when the user is faraway from any sales point that is open.

To remedy that drawback, proposals have been made to provide so-called“multi-application cards”, e.g. making it possible to pay for a publictelephone by means of a bank card.

Such multi-application cards are technically feasible, but in practicethey are administratively very difficult to implement, as has beendemonstrated by numerous pioneering attempts ever since the invention ofthe IC card itself.

OBJECT OF THE INVENTION

One of the objects of the present invention is to remedy thatdifficulty, by making use of two technical characteristics ofcontemporary microelectronics that are already implemented in modernmicrocircuit cards, specifically the presence of a reprogrammable memoryof the EEPROM type, and the presence of a microprocessor.

SUMMARY OF THE INVENTION

More precisely, the method of the invention which seeks to enable amicrocircuit card to be used in a plurality of applications comprising adefault application and at lest one target application, includes thefollowing steps: the card, initially configured for the defaultapplication, is coupled with a terminal of the default application; aspecial transaction is executed, reconfiguring the software of the cardfor the target application in such a manner that the card asreconfigured in this way emulates a card specific to the targetapplication; the reconfigured card is coupled with a terminal of thetarget application; and a target-application transaction is executed.

Subsequently, provision is made for steps of coupling the card asreconfigured for the target application with a terminal of the defaultapplication, and for executing another special transaction that causesits software configuration to return to the default application.

In other words, under the control of its main program, and on receivingan order from a working terminal that has been suitably adapted for thismulti-functionality, the card can be “reconfigured” so as tofunctionally emulate the missing card.

Once equivalent to the missing type of card (physically of course, butabove all in terms of software), i.e. equivalent to a card for thetarget application, the original card can be used to perform the desiredtransaction (in the target application).

After being used in the target terminal, and on being returned to itsoriginal terminal, the card will receive therefrom an order to“configure” itself back to its original type.

Most advantageously, the default application is a SIM card applicationfor a GSM radiotelephone, and the target application is an applicationof the token-carrier type.

Given the very large number of GSM telephones in circulation, it isirritating (because it seems paradoxical) for a user to observe that apresently-needed parking card is not available even though anothermicrocircuit card such as the card for controlling of the radiotelephoneis indeed to hand, with said card generally being inserted in theradiotelephone and generally being switched on.

Under such circumstances, the invention makes it possible to give theuser a way out, by taking advantage of the availability of a powerfultelecommunications network (the radiotelephone network), itselfconnected to the vast network constituted by the switched telephonenetwork (STN).

In another implementation, the default application is a bank cardapplication, and the target application need not only be a token-carriertype application, but can also a SIM card type application for GSMradio-telephony.

Or indeed, the default application can be an electronic purse typeapplication, with the target application being a bank card typeapplication enabling said electronic purse to be refilled.

Most advantageously, in order to avoid any interference betweenapplications, provision is also made to apply a general reset operationto the RAM zone of the card each time its software configuration ischanged. When the card has read/write memory, this general resetincludes erasing the read/write memory.

This general reset can be performed in various ways: by applying asignal on a special control line; by enabling a memory address gate; orindeed by executing a specific sequence of instructions, in particularinstructions of the card's operating system, instructions ofapplications software stored in the card, or indeed instructions in themicrocode of the card's processor.

Advantageously, the card has non-volatile memory that is subdivided intodistinct zones that are respectively usable for each applicationexclusively, and configuring the card for any one of the applicationsforces addressing to remain within the corresponding zone of theconfigured application until the card is reset. In addition, thenon-volatile memory may also have a single common zone, that isaddressable in a plurality of card configurations, and that receivesparameters to be transferred between successive applicationscorresponding to said configurations.

The card also provides a system for implementing the above method, andcomprising: microcircuit cards including means enabling the defaultapplication to be executed, means enabling the target application to beexecuted, and switch means enabling the card to be configured on commandeither as a default application card or as a target application card;default application terminals suitable for executing transactions of thedefault application and also a special transaction suitable for applyinga reconfiguration command to reconfigure the card for the targetapplication; and target-application terminals suitable for executingtarget-application transactions.

Advantageously, the default-application terminals are also suitable forexecuting another special transaction suitable for applying a command tothe card for causing it to return to the default-applicationconfiguration.

They may also include control means made available to the bearer of thecard enabling the bearer to initiate said special transaction or saidother special transaction.

Advantageously, the card has a non-volatile memory element, inparticular a non-volatile D-type bistable, that conserves in permanentmanner data identifying the current software configuration (functionnumber) of the card, and/or a memory element, in particular a D-typebistable, storing said data throughout the duration of the session.

In another particular implementation, the switch means comprise meansthat produce synchronization signals for sequencing the operationsgoverning resetting of the card and changing its function.

Similarly, it is possible to provide means for jointly paginating all ofthe memory matrices of the card, whether volatile or otherwise, andwhether programmable or otherwise.

BRIEF DESCRIPTION OF THE DRAWINGS

Other characteristics and advantages of the invention appear from thefollowing detailed description of various implementations given withreference to the accompanying drawings, in which the same numericalreferences are used to designate elements that are functionally similar.

FIG. 1 is a diagram showing the various means and players in the methodof the invention.

FIG. 2 is a block diagram showing the structure of a microprocessortoken-carrier type circuit.

FIG. 3 is a block diagram showing the typical organization of thecircuits in a GSM radiotelephone.

FIG. 4 is a block diagram of a microcircuit of a card of the invention.

FIG. 5 shows an embodiment of the subassembly of the FIG. 4 microcircuitthat is dedicated to the token carrier application.

FIG. 6 shows a variant embodiment of the FIG. 4 circuit.

FIG. 7 shows a variant embodiment of the circuit of FIGS. 4 and 6.

FIGS. 8 and 9 show two possible variants of a circuit combining thevarious switch functions in a single component.

FIG. 10 shows an example of a circuit implementing the switch componentof FIG. 9.

FIG. 11 shows an embodiment enabling a selection to be made between anindeterminate number of different functions.

FIG. 12 shows another form of circuit enabling selection to be performedbetween an indeterminate number of different functions.

FIG. 13 shows the structure of a switching circuit.

FIG. 14 shows the switching circuit of FIG. 13, associated with aprocessor circuit specific to an application.

FIG. 15 shows an example in which six circuits of the kind shown in FIG.14 are associated in such a manner as to create a six-function IC card.

FIG. 16 shows a variant of FIG. 12, further including aninter-application transfer register.

FIGS. 17 and 18 show memory configurations with parameter transfer,respectively for a two-application system and for a four-applicationsystem.

FIG. 19 shows a circuit incorporating the memory configured in themanner shown in FIG. 17.

FIG. 20 is a block diagram of the circuits of a card implementing theteaching of the invention.

FIG. 21 shows in greater detail the structure and interconnection of thevarious functional blocks of FIG. 20.

FIG. 22 shows a variant of the FIG. 21 circuit.

FIG. 23 is a timing diagram comparing three sequencing phases for thecircuit of FIG. 22.

FIG. 24 is a variant of the FIG. 20 block diagram.

FIG. 25 is equivalent to FIG. 24, using a linear representation.

FIG. 26 shows in greater detail how the central processor unit and thememory manager circuit of FIG. 24 are interconnected in a hardwareimplementation.

FIG. 27 shows how the FIG. 26 interconnection can be modified in asoftware implementation.

FIG. 28 is a flow chart showing how write or read memory access aremanaged in the context of the invention.

FIG. 29 is a flow chart showing the operating principles of a reader.

DESCRIPTION OF THE PREFERRED EMBODIMENTS

FIG. 1 shows the organization and the general operating sequence of themethod of the invention.

By way of example, a GSM radiotelephone card (SIM card) is describedthat can be used by the method of the invention in the context of atoken-carrier type transaction such as a transaction for paying forparking where payment is performed by deducting units (or “tokens”) froma microcircuit card.

The subscription taken out by a user 10 from the company 12 operatingthe user's radiotelephone 14 includes not only general radiotelephoneservice, but also a special service, e.g. payment for parking, where theamount will be included as a specific item in the monthly listing oftelephone consumption received from the operator 12 (billing representedby 16).

After parking a car close to an electronic “pay-and-display” parkingmeter machine 18 programmed to accept payment from prepaid cards issuedby the city 20 (e.g. cards of the “Paris Card” type), the driver mightfind that no usable parking card is available or that the card isexhausted or invalid.

To perform the payment required by the machine, the user then engages a“parking” command on the radio-telephone, e.g. by pressing on a button22 or by selecting an option in a menu giving the optional servicesoffered by the telephone operator. This command causes the SIM card 24of the radiotelephone to be “reconfigured” (see below) as a parking cardof the “Paris Card” type.

The user then extracts the card 24 from the radio-telephone and insertsit (arrow 26) into the machine 18, which perceives the card as being aparking card, and the card is then operated and debited as such.

The user then reinserts the card 24 (arrow 28) into the radiotelephone14 where it is read by the radio-telephone which automaticallyreconfigures it for the GSM function.

Once the parking total 32 has reached a predetermined amount (that issufficiently large so as to optimize billing costs), the radiotelephone14 takes advantage of a normal telephone call to inform the operator 12(arrow 30) not only about the parameters of the call which has justtaken place, but also the value of the parking total 32 at that time.

The same amount, credited by the operator 12 in favor of the city 20(arrow 34) may possibly include a compensatory commission since the cityhas been saved the price of manufacturing and distributing a cardspecifically for parking.

FIG. 2 is a block diagram showing the general structure of atoken-carrier type component having a microprocessor: an EEPROM memorycomponent 36 is installed on the output bus 38 of the microprocessor 40,while the input bus PE 42 receives data coming from the memory 36 andfrom the fuse 44.

FIG. 3 is a block diagram showing the general organization of a GSMradiotelephone. This comprises a microprocessor 46 connected to aboth-way bus 48 communicating with some number of members:analog-to-digital and digital-to-analog converters 50 and 52 operatingthe handset 54, a keypad 56, analog-to-digital and digital-to-analog HFconverters 58 and 60 operating the antenna 62, and finally a connectorenabling both-way communication to be established with the contact area64 of the IC card of the radiotelephone (SIM card).

FIG. 4 is a block diagram showing the general structure of a card of theinvention, i.e. a card that is capable selectively of performing boththe SIM card function for GSM and the token-carrier card function.

This card communicates with the outside world via a contact area 64. Afirst functional block 66 enables the token-carrier application to beexecuted and a second functional block 68 enables the GSM application tobe executed. A general decoder 70 communicates with the contacts 64 viathree lines: I/O 72, CLK 74, and RST 76, which lines are naturally inaddition to a power supply line VCC and a ground line GND. A common bus71 interfaces the decoder with the two functional blocks 66 and 68.

The assembly is under the overall control of a variable CF (cardfunction) which can take two values: 0 (GSM function) or 1(token-carrier function). This choice is stored in a memory locationillustrated to clarify the drawing as being in the form of a 1-bitEEPROM memory referenced 80, but which in practice can be constituted bya location in the main memory at an arbitrary address.

This variable CF is changed by the user each time the user presses thebutton 22 (FIG. 1) on the radio-telephone (or activates an appropriateoption in a menu). The software supervisor loop in the radiotelephoneperiodically examines the state of the button and on each occasion thatthe button 22 is pressed it sends a command to the card which isrecognized by the decoder 70 to produce a CHANGE_FUNCTION signal on anoutput 82, which signal is applied to an EXCLUSIVE-OR gate 84 whichwrites the new card function CF in the memory 80 by complementing theprevious state of the card function. The card function CF available onthe output 86 of the memory 80 makes it possible to operate alternatelyin token-carrier mode and in GSM mode via respective enable inputs 88and 90 of the circuits 66 and 68, which inputs are interconnected via aninverter 92.

This changeover between the two functions can also be implemented insoftware form. Thus, if the commands received by the card aretemporarily stored in a register CMD, the changeover algorithm can besummed up by the following sequence of instructions that are expressedin metalanguage:

while Button On/Off

wait CMD

CF=CF⊕(CMD=Change_Function)

On CF Call Action(CF)

wend

The function Action(CF) steers the sequence towards an action of type 0(GSM) or type 1 (token carrier) depending on the value of the cardfunction CF:

if CF=0 then Function_(—)0 (GSM)

if CF=1 then Function_(—)1 (token carrier)

Return

FIG. 5 shows an example of the block structure 66 for controlling atoken-carrier function. The block 66 comprises a memory 94 which iscyclically addressable by the an address counter 96. The counter has 256steps, it has a clock input UpAdr and a clear input ClAdr under thecontrol of a driver circuit 98, itself interfaced with the generaldecoder 70 by the bus 71. A detector 100 gives the address range [0,95]referred to as the “fuse zone” in which writing is authorized only ifthe fuse 102 is still intact. The write controller 104 filters writecommands upstream from the R*/W input 106 of the memory 94. The writecontroller 104 acts via the gate 108 to authorize any write requestproviding the fuse 102 is intact. Otherwise write authorization dependson the value of the current address, as given by the detector 100.

These functions can be implemented in software form by the followingsequence of instructions:

if current Address>255 then force Address to zero

Test the Command:

if the Command is Clear Address (ClAdr),

then Clear the Address: Return

if the Command is Increment Address (UpAdr),

then Increment the Address: Return

if the Command is Read the Memory,

then Read_Memory: Return

if Fuse Intact, then Write_(—)1: Return

if Address Outside Fuse Zone, then Write_(—)1

Return

When it is desired to use the card as a token carrier, in this examplefor paying for parking, the process of operating the card comprises (i)initially configuring the GSM card as a token-carrier card with theagreement of the radiotelephone operator and of the city; and (ii) useproper of the card by deducting the tokens that have been storedtherein.

This process can be summarized by the following sequence ofinstructions:

while On wait CMD while CMD = Change_(—Function AND CF = 0)Radiotelephone calls Authority (city) Authority (city) creates VPC(“Virtual Parking Card”) [VPC] = Fuse_Zone No., content Token_ZoneAuthority transmits VPC to Radiotelephone Radiotelephone copies VPC intodedicated zone CF = 1 wend CF = CF ⊕ (CMD = Change_Function) On CF CallAction(CF) Radiotelephone increments Total Total <- Total + debitedTokens while Total > 100 units Radiotelephone calls Authority (city)Radiotelephone sends Total Total <- zero wend wend

Numerous variant embodiments of the invention can naturally beenvisaged.

Thus, FIG. 6 is a variant of FIG. 4 in which the mechanism for switchingbetween the two functions is reduced to an emulated D-type bistable,assuming that this member is implemented using technology identical tothat of the main memory (EEPROM). The bistable 110 is triggered via itsclock input 112 by the CHANGE_FUNCTION signal 82 issued by the generaldecoder 70. The two complementary outputs Q and Q* of the bistable 110are connected to the respective enable inputs 88 and 90 of thetoken-carrier block 66 and of the GSM block 68, which are incommunication with the decoder via the both-way bus 71.

In addition, the pair of applications comprising GSM and token carrier,and in particular GSM and parking payment, is naturally not limiting,and other pairs of applications could also be envisaged.

Most particularly, the main function of the multi-function card of theinvention (i.e. the default function for which the card was initiallyissued and configured) could be a bank card (BC) type function, with thesecond function being a GSM function.

Under such circumstances, after the multi-function card of the inventionhas been manufactured and prior to it being “personalized”, cards areloaded with a BC type first application. It is in this state that thecards are supplied to a bank by the card manufacturer: at this stage,the cards are thus bank cards and approved as such by the bank.

The next step consists in personalizing the cards by recordingauthorization keys therein. This guarantees that these cards operate incompliance with the rules specific to the banking application, and tothis bank in particular.

The bank then issues the cards to its customers, who therefore canbenefit from the ability of these special cards, optionally, to acquirea second function.

To do this, the cards are loaded by a mobile telephone operator with aGSM application beside the BC application that has already been recordedindelibly.

The functions implemented can be summarized by the following sequence ofinstructions:

while Button On/Off wait CMD gosub LoadFunctionBC gosub LoadFunctionGSMif CF = 0 then GSM if CF = 1 then BC if CMD = “Change_Function” then CF= CF* wend GSM: gosub Alarm Function GSM proper Alarm = Status (alarmlevel) Return BC: Function BC proper Alarm = Status (alarm level) ReturnAlarm: if Alarm=0 then Return call Bank, GSM dialog Bank <-> GSM Alarm =0 Return LoadFunctionGSM: if GS = 1 then Return if “Key(LoadGSM) = OK”then Return Download ApplicationGSM GS = 1 (GSM function activated) CF =0 Return LoadFunctionBC: if BC = 1 then Return if “Key(LoadBC) = OK”then Return Download ApplicationBC BC = 1 (BC function activated) CF = 1Return

In particular, such cards can be issued by bank or credit establishmentsfor use, in addition to conventional payment for purchases on the siteof sale, for operations of secure sale by correspondence or electroniccommerce (by videotex or Internet). Under such circumstances, the userwho seeks to order an article, instead of keying-in the bank card codenumber (PIN number) via a terminal (with all the risks of disseminationand fraud that that implies) can then use the special bank card,reconfigured as a GSM card, to call via the radiotelephone a voiceserver for checking authorization of card debiting and order validation.

FIG. 7 shows a variant of the circuit adapted to an assumption whereby,by convention, the change-function order corresponds to applying a “1”simultaneously on all three inputs I/O, CLK, and RST of the contact area64.

The instruction decoder can thus be constituted by a simple AND gate 114whose output 116 causes the state of an emulated D-type bistable 110 tobe changed (said bistable being made using EEPROM technology, withcircuitry that is not shown, but that comes within the competence of theperson skilled in the art). Two gates 118 and 120 operate in anti-phasedepending on the state of the bistable 120, the clock inputs CLK of thetwo chips 66 and 68, while the remainder of the bus (the three linesI/O, RST, and VCC 122, 124) is connected to the contact area 64.

In a variant, instead of switching on selection of the clock signal CLK,it is possible to switch the reset input RST of one or other of thechips 66 and 68, or indeed the I/O input and/or or output.

FIG. 8 shows a circuit using a single component 126 that combines all ofthe functions associated with switching. In addition to the terminalsVCC and GND, this component has three input terminals I/O, RST, and CLK,together with two output terminals CM1 and CM2 (for“CLK-Microprocessor-1 or -2). The component houses a bistable 128 and aspecial power supply circuit 130 which serves to cause the bistable 128to operate in EEPROM mode, so that it delivers, depending on its state,a signal on pin CM1 or CM2. The component 126 also has a three-input ANDgate 132 connected to the contact bus I/O, CLK, and RST, which serves todetect the function-change order which, by convention, is encoded “111”.

FIG. 9 shows a component referenced 134 which is a variant of thecomponent 126 of FIG. 8 and which makes it possible, using the sameinputs, to produce selectively a signal RM1 or RM2 (for“Reset-Micro-processor-1 or -2”), when it is desired to select one orother of the microprocessors by permanently forcing the RST input of thenon-selected microprocessor.

FIG. 10 shows an embodiment implementing the switch 134 of FIG. 9. Ascan be seen, the card has three standard members, namely the chips 66and 68 corresponding to each of the functions that it is desired toimplement selectively, and the contact area 64. These members areinterconnected by means of the component 134 described above withreference to FIG. 9 and by a five-line bus 136 having lines I/O, CLK,RST, VCC, and GND. Naturally, if a higher degree of integration isimplemented, it is technologically possible to unite all three members66, 68 and 134 on the same chip.

FIG. 11 shows an embodiment making it possible to switch between anarbitrary number of functions, and in particular a number greater tantwo, unlike the embodiments described above.

The circuit is constituted by a series of identical chips 138 eachincluding, in addition to members specific to each application (GSM,token carrier, bank card, etc.), a switch component 134 of the kindshown in FIG. 9, in particular with the gate whose purpose is to detectthe change-function order.

Each of the blocks 138 is provided with inputs FR (for “False Reset”)and VR (for “Verified Reset”). The input FR of the first block 138 isconnected to the RST contact of the contact area 34, while the input FRof each following stage is connected to the output RM2 of the switch 134of the preceding stage. The input VR which enables the functionalelements of the block under consideration to be deactivated is itselfconnected to the output RM1 of the switch 134 of its own stage.

This serves to chain blocks 138, with block selection taking placesequentially on each occasion that a change-of-function order isapplied.

FIG. 12 shows a circuit having two similar functional assemblies 140dedicated to respective specific applications, each having amicroprocessors 142 and an associated switch circuit 144.

The structure of the switch component 144 is shown in FIG. 13 andcorresponds essentially to the component described above with referenceto FIG. 9, having the emulated D-type bistable 128 and an AND gate 132to detect the change-of-function order.

FIG. 14 shows a component 144 in the form of a functional block havingan input Din, an output Qout, and a link firstly to the general bus 136and secondly to the bus 146 of the microprocessor 142, having its RSTline controlled by the gate 146 (FIG. 13). The two functional blocks 140(switch 144 and microprocessor 142) can be integrated in a singlecomponent, optionally in the form of a universal chip, that can bepersonalized simply as a function of the desired application.

FIG. 15 shows the structure of a card having six such components 140organized to constitute a six-function card that is almost universal inusage: for example it may comprise a bank card+an electronicpurse+GSM+an identity card+an Internet card+a cryptographic module. Eachof the blocks 140 is connected to a common bus 136; the D input of eachblock is connected to the Q output of the preceding block in a chainingorder.

FIG. 16 shows a circuit derived from the above circuits in which thevarious applications that are used in succession can transfer parametersbetween one another via a register 148. This register is implementedusing non-volatile technology, and in its simplest configuration is an8-bit EEPROM register (with box 150 containing those elementsimplemented in EEPROM technology whose information state does not changebetween two uses of the card, and the same applies to the EEPROM memoryzones 152 of the microprocessors 142). The zone 150 includes, inparticular, the switching circuits 144 which are of the same type asthose described above with reference to FIG. 13.

The register 148 is connected to the common I/O bus of themicroprocessors, and its write input is constituted by the set of STOtype outputs coming from the various microprocessors, as multiplexed bythe gate 154. Similarly, each microprocessor can read the contents ofthe register by applying an RCL order, as multiplexed by the gate 156.In a manner that is characteristic of a variant embodiment of thisinvention, because there is only ever one microprocessor active at thesame time in the card, there is no risk of conflict or collision inreading or writing, nor is there any risk in the invention of amicroprocessor of order N writing or reading data in theparameter-passing register simultaneously with one (or more)microprocessors of order N′≠N being active.

Most advantageously, on each change of function, all of the circuits ofthe card are reset, specifically to avoid any interference betweenapplications or any risk of data being transferred between them otherthan via the non-volatile register 148.

FIGS. 17 and 18 show a particular organization for the non-volatilememory that enables the same memory to house simultaneously both zoneswhich are reserved to respective applications and the register forpassing parameters between them (corresponding to the register 148 ofFIG. 16). This particular logic organization serves to avoid creating anon-volatile memory space other than the EEPROM space 158.

For a two-application card, corresponding to FIG. 17, the EEPROM 158 isorganized with a first zone 160 at address zero that is used for passingparameters between applications (corresponding to register 148 in FIG.16), a zone 162 (addresses 1 to 16,384 in this example) reserved forapplication No. 1, followed by a zone 164 (addresses 16,385 to 32,768 inthis example) reserved for application No. 2.

In the simplest embodiment described herein, both applications are ofequal dimensions, however the person skilled in the art can, whereappropriate, provide special address-decoding resources to make use ofapplications that are of dimensions that are different, or indeed verydifferent. In this respect, it will be observed that it suffices toprovide a small number of additional gates to be able to manage avariety of respective proportions between applications (½, {fraction(1/16)}, {fraction (1/128)}, etc.) and also a variety of numbers ofapplications coexisting on the same card (2, 4, 16, etc.).

The processor associated with this memory is configured (see below) insuch a manner as to provide complete isolation between the twoapplications, i.e. the zones 162 and 164 can never be usedsimultaneously during the same session. This is to prevent any possibleinterference between the two applications.

As mentioned above, it is possible, most advantageously, to provide forthe card to be reset (automatic stop, special instruction sequence, ordisconnection) each time a change-of-function order is executed. Thisimposed disconnection erases the RAM in the card and eliminates any riskof parameters being passed from one application to the other via theRAM, thus guaranteeing isolation between applications.

It should be observed that this guarantee is naturally unlimited, andthat the chip designed in this way will withstand indefinitely anyattempt at logical attack. The present invention thus teaches acombination of means that are certain to achieve the desired object.

FIG. 18 corresponds to FIG. 17 but for the case of a card having fourapplications. In this example, in addition to the zone 160 for passingparameters (address zero), four distinct 8-Kbyte zones 162, 164, 168,and 170 are allocated to each of the four applications.

FIG. 19 shows a circuit for managing the memory shown in FIG. 18 withall of the desired guarantees as to isolation between applications. Thesecurity of each function is, in this manner, strictly that of its ownsoftware, without the additional function(s) adding any further risk,and this remains true in spite of the possibility of parameters beingpassed between applications.

This circuit is organized around a standard chip 172 comprising amicroprocessor 174 associated with an input/output control circuit 176,an address generator 178, and RAM 180. This circuit makes use of datapresent in the non-volatile memory 158 via a data bus 182. The threelines (RST, CLK, and I/O) coming from the contact area 64 communicatewith the microprocessor via the special both-way bus 184.

The address generator 178 provides the addresses required by the memory158 under the control of a gate 186 designed to force the bus 188 tozero (which bus carries the thirteen least significant bits A0-A12 formemory addressing) in the event of an RST command being applied to thecorresponding contact of the contact area 64.

The line 190 controls read/write operations both in RAM and in EEPROM,while the register 192 (parameter/function register) can be modifiedonly via the signal 194 delivered by the gate 196. This signal 194represents detection of the address zero on the bus 188, which has theeffect of forcing to zero the two most significant address bits A14 andA15 via gates 198 and 200. The register 192 (which in practice isconstituted by a fragment of the RAM 180 specific to themicro-processor) is loaded from the both-way data bus 182 each time theaddress zero is forced.

The data then available on the bus 182 at the outlet from the memory 158represents the contents of the physical “zero” address, i.e. thecontents of the register for passing parameters via non-volatile memory.This register 158 stores two bits 202 encoding the active application(Nos. 0, 1, 2, or 3), and six bits 204 for passing a parameter(naturally this format is not limiting).

Because total isolation is guaranteed between the applications whilestill allowing a parameter to be passed on input and output to or froman application, the invention can be made particularly advantageous whenone of the applications is a cryptographic application, since this makesit possible to guarantee that cryptographic processing is executed incompletely secure manner since no damage to the cryptographic process ispossible by means of malicious instructions recorded in the mask for themain application.

In the context of a bank application, this cryptographic application cancorrespond, for example, to a function which enciphers the certificatenumber and possibly other parameters, with the result being stored at anaddress in the non-volatile memory (e.g. the address zero) where theparameters can be recovered by the bank application.

The sequence can thus be as follows:

a) conventional bank card processing (verifying bank identity, expirydate, stops, if any, solvency);

b) writing non-volatile parameters in address zero (bank identity,amount, date, certificate);

c) changing function: resetting the RAM matrices of the card to zero,and activating the cryptographic module; and

d) reading the contents of the memory at address zero, enciphering andremotely transmitting the result via the cryptographic module.

By way of example, the cryptographic software can be delivered in theform of a graphics mask covering half of the physical spacecorresponding to the EEPROM memory plane (which space was left untouchedafter initialization for the bank function).

To sum up, the system of the invention as described above presents thefollowing four important distinctive characteristics:

1) Alternate processing for two applications (or more generally Napplications): this processing is “alternate” in the sense that there isnever any interleaving between two applications, each of them isexecuted separately, and all of the “live” elements of the card arereset (i.e. lose all information once powered-down) on each occasionthat the system passes from one application to another. In addition,when applications make use of memory in common, the memory ispartitioned into two distinct zones (top zone and bottom zone) which,given the structure of the addressing circuit, can never be addressed insuccession during the same session, with changeover from one zone toanother of the memory necessarily implying a change of function and thusthat all of the live elements of the card have been reset, therebyavoiding any risk of interference between successively-calledapplications.

2) Erasing RAM: on each change of function, the RAM and all of the livefunctions (bistables, registers, stack(s), etc.) are erased (and indeedwhenever the card is disconnected from the reader), thereby guaranteeingcomplete “isolation” between applications.

3) Parameter passing: communication between applications is strictlylimited to interchanging data via non-volatile common space (since RAMis erased, no parameter can pass via RAM).

4) The number of the active function is taken into account: eitherautomatically on each occasion that the card is powered, or else underthe control of the commands received via the contacts of the card, or asgenerated by the microprocessor itself.

FIG. 20 is a block diagram of circuits 300 in a card implementing theteaching of the invention.

Essentially, a central processor unit CPU 302 is connected to thecontacts RST, CLK, and I/O of the contact area 64, and communicates withthe other circuits via an address bus ADR 304 (typically using 14 bits)and via a data bus DATA 306 (typically using 8 bits). The CPU 302 alsogenerates four special control signals POR, ChgF, R*/W, FNo on a bus308, which signals are described in greater detail with reference toFIG. 21.

Provision is also made, in conventional manner, for a read-only memory(ROM) 310, a read/write memory (RAM) 312, and a non-volatile memory(EEPROM) 314.

The ROM 310 and the RAM 312 are connected to the CPU 302 and arecontrolled in conventional manner via the address bus 304 and the databus 306.

In contrast, access to the EEPROM 314 is managed by a modest memorymanagement unit (M3U) 316 that is specific to the invention.

The M3U 316 is connected to the EEPROM 314 via a 14-bit address bus 318and a write control line R*/W 320. It is also connected to the leastsignificant bit line (bit 0) of the data bus 306 by a line 322 enablingit to force the value of this bit.

FIG. 21 shows the structure of these various elements in greater detailtogether with the signals interchanged between them.

The CPU 302 performs three essential functions:

1) that of an address generator, operating directly for the ROM 310 andthe RAM 312, and via the M3U 316 for the EEPROM 314;

2) that of generating the four special signals POR, ChgF, R*W/, and FNoon the bus 308 for application to the M3U 316; and

3) that of a processor for executing various calculations andprocessing.

The various abbreviations used in this figure are as follows:

POR: Power-On Reset (an order to reset the circuit when power is appliedthereto, this order occurs once only during a session);

ChgF: change function, controlled either internally by the CPU 302, orexternally, e.g. by simultaneous application of signals on the threecontacts RST, CLK, and I/O;

R*/W: an order to write in memory;

FNo: function number (0 or 1);

CSR: Chip Select for the Read only memory ROM;

CSV: Chip Select for the volatile RAM;

CSP: Chip Select for the Programmable non-volatile memory;

R*/W.V: write to RAM;

R*/W.P: write to programmable non-volatile memory;

A0A13: the 14 least significant address bits of the EEPROM 314;

A14: the most significant address bit of the EEPROM 314;

I/O: the eight data bits read or written from or to the variousmemories;

bit0: the least significant bit of the data bus DATA;

ADR0: a signal indicating that the CPU 302 is addressing address zero ofthe EEPROM 314 (i.e. the zone for passing parameters);

BLOCK: address blocking so as to prevent the address pointer of theEEPROM 314 from changing position; and

HiZ: validating the function number (value “FALSE”) to enable it to bewritten to the most significant bit position of address zero in theEEPROM 314 (parameter-passing zone).

The M3U 316 is constituted by a very small number of gates 324 to 338for managing access to the EEPROM 314 by the CPU 302 in completesecurity concerning isolation between the various applicationsconcerned, since they can communicate with one another only via theparameter-passing zone which is situated at address zero of this memory.

The gates 324 and 326 which control the most significant bit A14 enableEEPROM 314 address zero to be forced so as to address theparameter-passing zone, the gate 326 forcing memory address bit A14 to avalue (0 or 1) corresponding to the function number FNo.

The gates 328 and 330, in combination with the gates 332, 334 forstoring state, operate at the moment of general reset (POR) whichoccurs, as explained above, each time function is changed. At thismoment, the addresses A0A13 and the address A14 are forced to zero, thuspointing to the parameter-passing zone and making it possible to recoverany parameters left in said zone by the previously-used application.

The switch 336 and the gate 338 act to control the writing of parametersthat are to be transferred in the parameter-passing zone of the EEPROM314.

FIGS. 22 and 23 show a variant embodiment of the circuit of FIG. 21.

In this variant embodiment, the successive steps are synchronized by athree-phase clock producing three clock signals φ1, φ2, and φ3 which areshown together in FIG. 23 and which have duty ratios over one cycle ofthe clock C lying in the range 80% to 20%, for example, and decreasingwithin said range. Thus, for a clock cycle of duration C=1 μs:

the signal φ1 is at “0” for 0.2 μs and then at “1” for 0.8 μs;

the signal φ2 is at “0” for 0.4 μs and then at “1” for 0.6 μs; and

the signal φ3 is at “0” for 0.6 μs and then at “1” for 0.4 μs.

These phases φ1, φ2, and φ3 are produced by a time control circuit 340which also generates the signal POR on detecting corresponding signalson the contact area 64.

The signals φ1, φ2, and φ3 perform sequencing via gates 342, 344, 346,and 348 that are made conductive selectively and successively by thevarious signals φ1, φ2, and φ3 (initially gate 342 by φ1, then gates 346and 348 by φ2, and finally gate 344 by φ3).

During automatic resetting on power-up of the card, the address A0A13and the bit A14 are forced to zero during φ1 by the gate 342: the signalPOR propagates via the gates 328, 342, 330, 324, and 326 (forcing ofA14), with the forcing of the address A0A13 taking place solely via thegate 330.

During the following stage φ2, the D-type bistable 350 stores involatile manner the bit B7 of the data bus taken from the non-volatilememory 314, which bit is the inverse of the function number FNo.

As operations continue, i.e. after the signal POR has ceased, the mostsignificant address bit A14 takes the value which is the inverse of FNo,i.e. the value of bit B7 as sampled during power-up from address zero inthe non-volatile memory, the read/write operations being synchronized byφ3.

In the event of a request to change function, as detected by bate 132,operations take place as follows.

During φ1, the addresses are forced to zero.

During φ2, the present function number is sampled again from bistable350, and is then written (inverted) in bit 7 at address zero of thenon-volatile memory 314, via switch 336. After which (φ3), the bistable332, 334 is blocked in the address bus closure position indefinitely andunconditionally until the next time the circuit is powered-down.

FIG. 24 shows a variant of the block diagram shown in FIG. 20.

This figure has the same elements 300 to 322 as described above withreference to FIG. 20. The only functional difference between FIGS. 20and 24 lies in the fact that in FIG. 24, the EEPROM address bus 318,i.e. the address bus 304 after being processed by the memory managementcircuit M3U 316, also addresses the ROM 310 and the RAM 312, whereas inFIG. 20 these two memories were addressed by the bus 304 directlyconnected to the CPU 302; nevertheless, this difference has noconsequence on the operation of the system, since the operation of theM3U 316 is transparent, where appropriate, assuming that the circuitprovides no filtering concerning addressing of the ROM 310 or of the RAM312.

The advantage of this representation lies in showing up numerous axes ofsymmetry that facilitate understanding of the operation of the system ofthe invention:

beneath the horizontal axis XX, there are disposed: (i) permanent dataspecific to one card (EEPROM 314) or to all cards (ROM 310); and (ii)data means common to all cards (EEPROM 314 and ROM 310);

above the horizontal axis AA, there appears the specific combination ofthe two main means of the invention:

the M3U 316 which serves to calculate addresses, to control writing, andto enable any change of function, and also the contacts 64 which providecommunication between the card and the external terminal; and

the four flags 308 (POR, ChgF, FNo, and R*/W) whose instantaneous statesserve to control the M3U 316; above this vertical axis AA, there canalso be seen resources that contain no information when power is notapplied;

to the right of the vertical axis BB, there are disposed resources andfunctions for the CPU (general processing, in particular computationalfunctions, etc.), and also the resources necessary to enable them to beimplemented (ROM 310 and RAM 312);

to the left of the vertical axis BB, there is the usable non-volatilespace (EEPROM 314) together with the means specific for controlling it(M3U 316);

between the CPU 302 and the other components, there extend address lines(to the three memories) and communications lines (with the contact areas64);

on a first diagonal XX, there are to be found writable memories (RAM 312and EEPROM 314);

on a second diagonal YY, there are to be found the means required formaking use of the writable memories, specifically:

the ROM 310 governing the functions of the microprocessor of the CPU302; and

the logic circuit (M3U 316) supervising addressing and writing specificto the programmable memory (variable) EEPROM 314, both sending data tothe peripheral bus (data bus 306):

on the vertical axis BB, there are the two means which conventionallycharacterize a microprocessor IC card, specifically the contacts 64 incompliance with ISO 7816-3, and the CPU 302;

at the center of the configuration there is the CPU 302;

more generally, the ring surrounding the CPU (for circuits 310, 312,314, and 316) is entirely constituted by semiconductor circuits; and

with reference to the semiconductor circuits only, whose area isorganized as five blocks 302, 310, 312, 314, and 316, it can be observedhat:

the center and the top left quadrant are occupied by “raw logic”; and

the other three quadrants are constituted by memory matrices.

Naturally, the representation of FIG. 24 is not exclusive, and it ispossible, for example, to envisage a “linear” representation as shown inFIG. 252, which is functionally equivalent to that of FIG. 24, and whichmay possibly constitute a subassembly of some more complex architecture.

FIG. 26 shows in greater detail how the CPU 302, the M3U 316, and theaddress and data buses 318 and 306 are interconnected (with the internalstructure of the M3U 316 corresponding to that shown in FIG. 21 asdescribed above).

The CPU 302 issues addressing signal A0A13 and the four flags POR, ChgF,FNo, and R*/W, with all of these signals being applied as inputs to theM3U 316 by the bus 304 and the four lines 308.

The M3U 316 outputs the address signal A0A13 which is applied to thegeneral address bus 318, together with address bus A14 as generated inthe manner described above.

The M3U also delivers the read/write signal R*/W as filtered to enableconditional writing to the EEPROM in compliance with the rules describedabove. It also produces a data bit which is applied in the form of asignal 322 to the line which corresponds to bit zero of the data bus306.

The structure described above corresponds to a hardware implementationof the invention.

It is possible to replace such a hardware implementation with a softwareimplementation, by appropriately programming the microcode of the CPU302, or indeed the operating system of the card's micro-processor.

When such a replacement is performed, it is possible to conserve thesame general architecture as above and as shown in FIG. 24, merelyreplacing the hard-wired logic of the unit 316 in FIG. 26 by simpleinterconnection lines as shown in FIG. 27 (which lines are made ofaluminum on the semiconductor).

Under such circumstances, the interconnection performed by the unit 316restores the bits A0A13 of the address signal at its output and also theread/write command R*/W, and it forces address bit A14 to zero, e.g. byzeroing the inputs POR, ChgF, and FNo of the M3U 316 and byinterconnecting the input FNo and the output A14 of said circuit.

In this particular aspect, the M3U of the invention can be considered asbeing an additional component which improves functional performance(ergonomy, security) and the addressability of the memory, by enrichingit with write functions. This component can be integrated in evolvingmanner in various generations of cards, for example:

First generation: the general architecture of the cards is as shown inFIG. 24, with a hard-wired M3U, as shown in FIG. 26; the functionsspecific to the invention are encoded in part in the ROM, and in part inthe EEPROM.

Second generation: evolution of the CPU enables microcode to beincorporated specific to authorizing the encoding of the functions ofthe invention.

It may be observed that cards in these two first generations continue toexecute exactly the same functions as before without any significantdegrading of their physical performance (speed and/or powerconsumption), implementation of the invention typically requiring only afew individual clock cycles (for a microcode implementation), or passingthrough three logic layers (for a hard-wire logic implementation).

Third generation: the circuits on board these cards progressivelyincorporate sequences within their own operating systems suitable forexploiting functions of the invention (alternating between applicationsand selecting desired functions), with the operating system thusreplacing the microcode. A particularly advantageous characteristic ofthe invention is that no prior steps are essential in order to be ableto take advantage, even if only partial advantage, of the properties ofthe invention: new cards can easily coexist with a very large populationof single-function cards.

As to adapting dialog between the user and the card/terminal interfaceconcerning changing function, that can be downloaded into the terminal.

FIG. 28 is a flow chart showing the sequence 400 of the variousoperations performed in the event of generalized memory access to anEEPROM shared between two applications.

In practice, this flow chart can be implemented in various differentways:

either by conventional software programming for the processor of thecard, with this remaining under the control of the card's own operatingsystem;

or in the form of microcode directly driving the processor (a softwarelayer that is not programmable from outside the CPU);

or in a form which is hard-wired in part or in full, in which case theflow chart represents the various stages in the sequential processimplemented by the circuitry of the card.

In the flow chart, the parameters POR, ChgF, A0A13, A14, FNo, and R*/Whave the same meanings as they do in the preceding figures, while orderssuch as “lda”, “cma”, “sta”, etc. have the meanings they usually have inmicrocode, i.e. respectively loading the accumulator of the processorwith the value read from the memory at the addressed location,complementing the accumulator, and writing the value present in theaccumulator into memory.

The sequence 400, after initial resetting operations 402, provides astep 404 in which the most significant address bit A14 is calculated,which bit is given a value that is equal to the function number (0 or 1in the case of a two-function system), assuming the reminder of theaddress field A0A13 is not zero.

The following step 406 verifies whether the flag POR is 0 or 1 at theend of the sequence 400 (why and how are explained below).

If the flag POR is 1, the sequence executes a series 408 of stepscorresponding to switching on (power-on reset, with the function numberFNo being saved). At the end of step 408, the flag POR is reset and thesequence ends in step 410 (forcing the write command R*/W to zero).

If during step 406 the flag POR is recognized as being zero, the processexamines the change-of-function parameter ChgF (step 412); if thisparameter is 1, then the present situation is that of a change offunction with parameters being passed, and this is handled in thespecial manner of the invention: the process then executes the sequenceof steps 414 for changing function with parameters being passed via anon-volatile zone, and above all for erasing the RAM (step 416) in sucha manner as to guarantee isolation between the application which isbeing closed and that which is about to be opened.

The parameter that is to be transferred is then written during step 418(a write command R*/W at 1 is issued for the time required for suchwriting), and then the process is brought to an end, as before, byresetting the R*/W command to zero and by returning to the main program(step 410).

The sequence 414 comes to an end by setting the flag POR to 1, thusmaking it possible on the next occasion that the sequence 400 isexecuted, to go directly to performing the reset operation 408, thereby“virtually switching off” the card, without there being any need todisconnect it physically.

When the read or write order corresponds neither to a reset nor to achange of function, i.e. when POR=0 and ChgF=0, and depending on whetherreading or writing is to be performed (step 420), the correspondingfunctions of a block 422 are performed, which block includes controlledread or write functions including the conventional safety mechanismsspecific to IC cards. These functions comprise: a write priority test(step 424, e.g. for directly writing a ratification bit), optionallyinhibiting writing to the addressed zone (step 426), and optionallyinhibiting reading of the addressed zone (step 428). Once these securityfunctions have been executed 422, and if the operation is authorized,then a read or a write is performed (step 432, or steps 430 & 418, orstep 418 directly), and the process comes to an end, as before, in step410.

In FIG. 29, there can be seen a flow chart showing an example of thesequence of operations performed by a reader, in this case a combinedreader that makes it possible both to perform payment in “bank card(BC)” mode (application “BANK”), or else in “electronic purse mode”(application “PURSE”).

The sequence begins with reset step 500 followed by answer to reset(ATR) step 502. This step specifies (tests 504 and 506) whether the cardunder test is actually configured in BANK mode or in PURSE mode.

At the following step (tests 508 and 510), the reader itself examinesits own type, i.e. whether it is of the electronic payment terminal(EPT) type suitable for performing a BC type transaction by the BANKapplication, or on the contrary it is a terminal of the beveragedispenser type, the parking meter machine type, etc., operating in“token carrier” mode (PURSE application).

If the card is configured in BANK mode and the reader is of thetoken-carrier type, or if the card is configured in PURSE mode and thereader is of EPT type, then a CF instruction for changing function(blocks 512 and 514, respectively) is issued to the card in such amanner as to make it compatible with this type of terminal.

The transaction can then be executed, either in bank card transactionmode (block 516) or else in PURSE transaction mode (block 518).

It is possible to envisage the situation in which the user, the holderof a combined BANK/PURSE card, which is presently configured in BANKmode, might attempt to use a device such as a beverage dispenser or aparking meter machine that is suitable for operating in PURSE mode only,and which has not yet been upgraded so as to enable it to perform theautomatic change of function as explained above.

Under such circumstances, it suffices for the user to find a reader ofany type that includes the special means of the invention for changingfunction (e.g. a GSM telephone carried by the user, a neighboring payphone, or a special peripheral of a personal computer, etc.). Aftercausing the function to be changed in said other reader, i.e. afterswitching the card into PURSE mode, the user can return to theold-generation dispenser, and make payment in its native PURSE mode.

A particular implementation as shown in FIG. 29, consists in using theterminal for refilling the PURSE by means of a BC transaction, initiallyby performing a BC transaction in which the bearer's account is debited,then loading the PURSE from the contents of a register that stores thevalue debited in this way. Naturally, the BC and PURSE type transactionsare separated by an order for changing function that causes the card tobe reconfigured from one mode to the other and that erases a maximumnumber of live elements on the semiconductor.

What is claimed is:
 1. A method of using a microcircuit card in aplurality of applications, the method comprising the steps of: takingthe card (24) as initially configured for a first application andcoupling it with a terminal (14); executing a special transaction toreconfigure the software of the card for a target application so thatthe card as reconfigured in this way emulates a card specific to thetarget application; and executing a transaction of the targetapplication; which method is characterized by the card, with theexception of its non-volatile memory, being subjected to a general resetto zero on each change of configuration.
 2. The method of claim 1, inwhich the first application is a default application, thereconfiguration step taking place when the card is coupled to a defaultapplication terminal, and the card as reconfigured in this way issubsequently coupled to a target application terminal to execute thetarget application.
 3. The method of claim 2, including the followingsubsequent steps: the card as reconfigured for the target application iscoupled with a terminal of the default application; and another specialtransaction is executed serving to return to the software configurationfor the default application.
 4. The method of claim 1, in which thefirst application is a SIM card application for GSM radiotelephony. 5.The method of claim 4, in which the target application is atoken-carrier type application.
 6. The method of claim 1, in which thefirst application is a bank card application.
 7. The method of claim 6,in which the target application is a SIM card application for GSMradiotelephony and/or a token-carrier type application.
 8. The method ofclaim 6, in which the first application is an electronic purse typeapplication and the target application is a bank card type applicationenabling the electronic purse to be refilled.
 9. The method of claim 1,in which the card includes read/write memory, and the general resetincludes erasing said read/write memory.
 10. The method of claim 1, inwhich the general reset is performed by applying a signal on a specialcommand line.
 11. The method of claim 1, in which the general reset isperformed by closing an addressing gate of the memory.
 12. The method ofclaim 1, in which the general reset is performed by executing a specificsequence of instructions, in particular instructions of the card'soperating system, the instructions of applications software stored inthe card, or indeed the instructions of the microcode of the card'sprocessor.
 13. The method of claim 1, in which the card has anon-volatile memory (158, 314) subdivided into distinct zones (162, 164;162, 164, 168, 170) usable respectively for each of the applicationsexclusively, the configuration of the card for any one of theapplications forcing addressing onto the zone corresponding to theconfigured application until the card is reset.
 14. The method of claim13, in which the non-volatile memory further includes a single commonzone (160) that is addressable in a plurality of configurations of thecard, and receiving parameters to be transferred between successiveapplications corresponding to said configurations.
 15. A system forusing a microcircuit card in a plurality of applications, the systemcomprising: microcircuit cards (14) comprising: means (68) enabling afirst application to be executed; means (66) enabling a targetapplication to be executed; and switch means (70-92) enabling said cardto be reconfigured on command either as a first application card or as atarget application card; terminals (14) suitable for executing atransaction of the first application; and terminals (18) suitable forexecuting a transaction of the target application; at least some of saidterminals being suitable for executing a special transaction suitablefor applying a reconfiguration command to the card to reconfigure it forthe target application so that the card when reconfigured in this wayemulates a card specific to the target application; the system beingcharacterized in that the switch means (70-92) in each card includemeans suitable, on each change of configuration, for imposing a generalreset to zero on the card, with the exception of its non-volatilememory.
 16. The system of claim 15, in which the first application is adefault application, the switch means (70-92) performing reconfigurationwhen the card is coupled to a terminal of the default application, thecard as reconfigured in this way then being coupled to a terminal of thetarget application to execute the target application.
 17. The system ofclaim 16, in which the default application terminals are also suitablefor executing another special transaction suitable for applying a returncommand to the card to cause it to return to the default applicationconfiguration.
 18. The system of claim 16, in which the defaultapplication terminals include control means (22) usable by the bearer ofthe card, enabling the bearer to initiate said special transaction orsaid other special transaction.
 19. The system of claim 15, in which thecard includes a non-volatile memory element, in particular anon-volatile D-type bistable (110, 128, 202), that conserves inpermanent manner a data item that identifies the current softwareconfiguration of the card.
 20. The system of claim 15, in which the cardhas a memory element, in particular a D-type bistable (110, 128, 202)storing a data item (FNo) identifying the current software configurationof the card throughout the duration of the session.
 21. The system ofclaim 15, in which the switch means (70-92) include means (340)producing synchronization signals (φ1, φ2, and φ3) for synchronizing thesequencing of operations for managing card reset and card change offunction.
 22. The system of claim 15, including means for jointlypaginating all of the memory matrices of the card, whether volatile orotherwise, whether programmable or otherwise.